CVE-2026-41917 is a local file inclusion vulnerability in OpenKM Community Edition 6.3.12 affecting the administrative scripting interface at /admin/Scripting. Authenticated administrators can manipulate the fsPath parameter with action=Load to read arbitrary files on the filesystem, bypassing intended directory restrictions. This allows access to sensitive system and application files, potentially exposing critical credentials and configuration data. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) and requires administrator privileges to exploit. No vendor advisory or patch information is currently available.

Exploitation of this vulnerability allows an authenticated administrator to read arbitrary files on the server hosting OpenKM Community Edition. This can lead to disclosure of sensitive information such as system user data (/etc/passwd), database credentials, and JVM keystores, which may facilitate further attacks or compromise of the system. The impact is limited to users with administrative privileges and does not involve privilege escalation or remote unauthenticated access based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for any unusual activity. Avoid exposing the administrative scripting interface to untrusted networks. No official patch or workaround information is currently provided by the vendor.